Case study · Education · Managed servicesStudi kasus · Pendidikan · Managed services

Slow school Wi-Fi? It was not the hardware.Wi-Fi sekolah lambat? Ternyata bukan perangkatnya.

How an education foundation in Indonesia fixed chronic Wi-Fi problems with minimal hardware replacement, and rebuilt its e-learning platform to serve thousands of students at once.Bagaimana sebuah yayasan pendidikan di Indonesia mengatasi masalah Wi-Fi yang menahun dengan penggantian perangkat minimal, lalu membangun ulang platform e-learning agar kuat melayani ribuan siswa sekaligus.

6schools, kindergarten to high schoolsekolah, TK hingga SMA

2,200+students, 300+ staffsiswa, 300+ guru & staf

100+Wi-Fi access pointsaccess point Wi-Fi

1login for school services (SSO)login untuk layanan sekolah (SSO)

Summary for managementRingkasan untuk manajemen

Before: Wi-Fi looked strong but was slow and unstable, and e-learning slowed down when classes logged in together.
Root cause: configuration, not hardware: too many network names, overlapping channels, transmit power set too high, and one flat network.
Now: Wi-Fi works reliably with minimal hardware replacement, Moodle serves thousands of students without slowdowns, and users sign in once through a central SSO for e-learning, SIAKAD, Microsoft 365 and more.
Resilience: schools are linked by an internal OSPF network with internet as a backup path, the database runs on a 3-node cluster, and servers are backed up centrally.
Regulation: supports the technical requirements of the Personal Data Protection Law (UU 27/2022), including children's data, and PP 71/2019 on electronic systems.

Sebelum: sinyal Wi-Fi terlihat kuat tetapi lambat dan putus-sambung, dan e-learning melambat saat kelas login bersamaan.
Akar masalah: konfigurasi, bukan perangkat: terlalu banyak nama jaringan, channel bertabrakan, transmit power terlalu tinggi, dan satu jaringan flat.
Sekarang: Wi-Fi andal dengan penggantian perangkat minimal, Moodle melayani ribuan siswa tanpa kendala, dan pengguna cukup login sekali lewat SSO terpusat untuk e-learning, SIAKAD, Microsoft 365, dan lainnya.
Ketahanan: antar sekolah terhubung jaringan internal OSPF dengan internet sebagai jalur cadangan, database berjalan di cluster 3 node, dan server di-backup secara terpusat.
Regulasi: mendukung ketentuan teknis UU Pelindungan Data Pribadi (UU 27/2022), termasuk data anak, dan PP 71/2019 tentang sistem elektronik.

Wi-Fi: before and afterWi-Fi: sebelum dan sesudah

BeforeSebelum

A different SSID for almost every classroom and area: beacons from many networks eat airtime, and devices cannot roam smoothly.
Neighboring access points on the same or overlapping channels, forcing them to take turns.
Transmit power at high levels: cells overlap, and devices cling to distant access points.
One flat network for students, staff, servers and other devices.

SSID berbeda di hampir setiap kelas dan area: beacon dari banyak jaringan menghabiskan airtime, dan perangkat tidak bisa roaming dengan mulus.
Access point yang berdekatan memakai channel sama atau berimpitan, sehingga harus bergantian bicara.
Transmit power tinggi: jangkauan saling tumpuk, dan perangkat menempel ke access point yang jauh.
Satu jaringan flat untuk siswa, staf, server, dan perangkat lain.

AfterSesudah

A few role-based SSIDs instead of one per room: roaming between classrooms is seamless.
Channel plan redone so neighboring access points no longer interfere with each other.
Transmit power tuned per area so each access point covers its own zone.
VLAN segmentation by role and function, keeping broadcast traffic and problems contained.

Beberapa SSID berbasis peran, bukan satu per ruang: roaming antarkelas mulus.
Channel planning ulang sehingga access point yang berdekatan tidak lagi saling mengganggu.
Transmit power disetel per area agar setiap access point melayani zonanya sendiri.
Segmentasi VLAN per peran dan fungsi, sehingga broadcast dan gangguan terlokalisasi.

A resilient network between schoolsJaringan antar sekolah yang tangguh

Most applications run on premises, so the link between units matters as much as Wi-Fi. The on-premises servers are hosted at one of the units; the others reach them over an internal network running OSPF, with each unit keeping its own internet access as a backup path.Sebagian besar aplikasi berjalan on-premises, sehingga jalur antar unit sama pentingnya dengan Wi-Fi. Server on-premises berada di salah satu unit; unit lain menjangkaunya lewat jaringan internal dengan OSPF, dan setiap unit tetap punya akses internet sendiri sebagai jalur cadangan.

Solid lines: internal links with OSPF, the primary path between units. Dashed lines: each unit's own internet, used between units only when an internal link fails. Topology simplified.Garis tegas: jalur internal dengan OSPF, jalur utama antar unit. Garis putus-putus: internet masing-masing unit, dipakai antar unit hanya saat jalur internal putus. Topologi disederhanakan.

E-learning built for peak loadE-learning yang siap beban puncak

Schools have a unique load pattern: hundreds of students sign in within the same minute when a lesson starts. The Moodle stack was redesigned around that peak.Sekolah punya pola beban yang unik: ratusan siswa login di menit yang sama saat pelajaran dimulai. Tech stack Moodle dirancang ulang untuk menghadapi puncak itu.

Simplified diagram.Diagram disederhanakan.

The solution, layer by layerSolusi, lapis demi lapis

WirelessWireless

RF review across 100+ access points: channel planning and transmit power tuned per area.
SSIDs consolidated from per-classroom names to a few role-based networks.
Hardware replacement kept to a minimum.

Peninjauan RF di 100+ access point: channel planning dan transmit power disetel per area.
SSID disatukan dari nama per kelas menjadi beberapa jaringan berbasis peran.
Penggantian perangkat dibuat seminimal mungkin.

NetworkJaringan

VLAN segmentation by role and function: students, teachers and staff, servers, other devices.
OSPF dynamic routing between all education units. Inter-unit traffic to on-premises applications runs over the internal links.
Each unit keeps its own internet access. If an internal link fails, traffic between units falls back to the internet path, so services stay reachable.

Segmentasi VLAN per peran dan fungsi: siswa, guru dan staf, server, perangkat lain.
Routing dinamis OSPF antar seluruh unit pendidikan. Trafik antar unit menuju aplikasi on-premises berjalan lewat jalur internal.
Setiap unit tetap punya akses internet sendiri. Jika jalur internal putus, trafik antar unit beralih lewat jalur internet, sehingga layanan tetap terjangkau.

Servers and backupServer dan backup

Several standalone Proxmox VE servers, hosted at one of the units, run the on-premises applications.
Proxmox Backup Server provides centralized, deduplicated VM backups for those servers.

Beberapa server Proxmox VE standalone, ditempatkan di salah satu unit, menjalankan aplikasi on-premises.
Proxmox Backup Server menyediakan backup VM terpusat dengan deduplikasi untuk server-server tersebut.

Moodle application tierLapisan aplikasi Moodle

Nginx tuned as the web server for many concurrent connections.
PHP-FPM process pools sized to the servers and to peak load.
Redis for Moodle caching and session storage, taking load off the database.

Nginx disetel sebagai web server untuk banyak koneksi serentak.
Pool proses PHP-FPM disesuaikan dengan kapasitas server dan beban puncak.
Redis untuk cache dan penyimpanan session Moodle, mengurangi beban database.

DatabaseDatabase

MariaDB Galera Cluster with 3 nodes and synchronous replication: if one node fails, the other two keep quorum and the database stays online.
MariaDB MaxScale in front of the cluster: routes queries and handles node failover transparently for Moodle.

MariaDB Galera Cluster 3 node dengan replikasi sinkron: jika satu node gagal, dua node lainnya tetap menjaga quorum dan database tetap berjalan.
MariaDB MaxScale di depan cluster: mengatur rute query dan menangani failover node secara transparan bagi Moodle.

Identity: single sign-onIdentitas: single sign-on

Keycloak as the central identity provider, proposed by me and adopted by the foundation.
One account and one login for e-learning (Moodle), SIAKAD (the academic information system), Microsoft 365 and other school services; access is granted and revoked in one place.

Keycloak sebagai identity provider terpusat, usulan saya yang diadopsi yayasan.
Satu akun dan satu login untuk e-learning (Moodle), SIAKAD, Microsoft 365, dan layanan sekolah lainnya; hak akses diberikan dan dicabut di satu tempat.

ResultsHasil

Wi-Fi fixedWi-Fi lancar

Chronic connection problems resolved with minimal hardware replacement.Masalah koneksi menahun teratasi dengan penggantian perangkat minimal.

ThousandsRibuan

of students use Moodle without slowdowns.siswa memakai Moodle tanpa kendala.

1 login1 login

Central SSO through Keycloak; access managed in one place.SSO terpusat lewat Keycloak; hak akses dikelola di satu tempat.

RF planningVLANMoodleNginxPHP-FPMRedisMariaDB Galera ClusterMariaDB MaxScaleKeycloak SSOOSPFProxmox VEProxmox Backup ServerManaged services

Regulatory alignmentKepatuhan regulasi

The design meets the technical side of these Indonesian regulations. Full compliance also needs organizational measures, such as privacy policies, parental consent and access governance set by the foundation.Desain ini memenuhi sisi teknis dari regulasi Indonesia berikut. Kepatuhan penuh tetap membutuhkan langkah organisasi, seperti kebijakan privasi, persetujuan orang tua, dan tata kelola hak akses oleh yayasan.

UU 27/2022 (PDP) · Pasal 4 (2) e

RequirementKetentuanChildren's data is classified as specific (sensitive) personal data.Data anak termasuk data pribadi yang bersifat spesifik.

How the solution supports itDukungan solusiContext: most users are minors, so student data calls for a higher level of protection.Konteks: sebagian besar pengguna adalah anak, sehingga data siswa menuntut tingkat perlindungan lebih tinggi.

UU 27/2022 (PDP) · Pasal 25

RequirementKetentuanProcessing of children's personal data is handled specially and requires parental or guardian consent.Pemrosesan data pribadi anak diselenggarakan secara khusus dan wajib mendapat persetujuan orang tua atau wali.

How the solution supports itDukungan solusiCentral identity in Keycloak gives one place to manage and audit student accounts. Consent itself is an organizational process of the foundation.Identitas terpusat di Keycloak memberi satu tempat untuk mengelola dan mengaudit akun siswa. Persetujuan orang tua sendiri merupakan proses organisasi yayasan.

UU 27/2022 (PDP) · Pasal 35 & 36

RequirementKetentuanControllers must apply technical measures to secure personal data and keep it confidential.Pengendali wajib menerapkan langkah teknis untuk mengamankan data pribadi dan menjaga kerahasiaannya.

How the solution supports itDukungan solusiVLAN segmentation separates student, staff and server networks.Segmentasi VLAN memisahkan jaringan siswa, staf, dan server.

UU 27/2022 (PDP) · Pasal 39

RequirementKetentuanControllers must prevent unauthorized access, using reliable and secure electronic systems.Pengendali wajib mencegah akses tidak sah, dengan sistem elektronik yang andal dan aman.

How the solution supports itDukungan solusiKeycloak SSO centralizes authentication for e-learning, SIAKAD and Microsoft 365: one account per user, access revoked in one place when a student or staff member leaves.Keycloak SSO memusatkan autentikasi untuk e-learning, SIAKAD, dan Microsoft 365: satu akun per pengguna, hak akses dicabut di satu tempat saat siswa atau staf keluar.

PP 71/2019 · Pasal 3 (1)

RequirementKetentuanElectronic system operators must run their systems reliably, securely and responsibly.Penyelenggara sistem elektronik wajib menyelenggarakan sistem secara andal, aman, dan bertanggung jawab.

How the solution supports itDukungan solusiManaged operation of Wi-Fi, network and servers; Moodle tuned for peak load; OSPF with an internet backup path keeps inter-unit services reachable.Pengelolaan Wi-Fi, jaringan, dan server secara berkelanjutan; Moodle disetel untuk beban puncak; OSPF dengan jalur cadangan internet menjaga layanan antar unit tetap terjangkau.

PP 71/2019 · Pasal 4 b

RequirementKetentuanSystems must protect the availability, integrity, authenticity, confidentiality and accessibility of electronic information.Sistem harus melindungi ketersediaan, keutuhan, keotentikan, kerahasiaan, dan keteraksesan informasi elektronik.

How the solution supports itDukungan solusiAvailability and integrity: 3-node Galera with MaxScale failover, plus Proxmox Backup Server for VM backups. Authenticity and confidentiality: central SSO and VLAN segmentation.Ketersediaan dan keutuhan: Galera 3 node dengan failover MaxScale, serta Proxmox Backup Server untuk backup VM. Keotentikan dan kerahasiaan: SSO terpusat dan segmentasi VLAN.

PP 71/2019 · Pasal 24 (1)–(2)

RequirementKetentuanOperators must have security procedures and systems to prevent and handle disruption, failure and loss.Penyelenggara wajib memiliki prosedur dan sistem pengamanan untuk mencegah dan menanggulangi gangguan, kegagalan, dan kerugian.

How the solution supports itDukungan solusiNo single database server (3-node Galera), centralized VM backups, redundant inter-unit paths, and segmentation that limits the spread of problems.Tidak ada server database tunggal (Galera 3 node), backup VM terpusat, jalur antar unit yang redundan, dan segmentasi yang membatasi penyebaran gangguan.

Sources: official texts ofSumber: teks resmi UU No. 27 Tahun 2022 tentang Pelindungan Data Pribadi anddan PP No. 71 Tahun 2019 tentang Penyelenggaraan Sistem dan Transaksi Elektronik. This is a technical mapping, not legal advice.Ini pemetaan teknis, bukan nasihat hukum.

Full signal, but nothing loads?Sinyal penuh, tapi tidak bisa dipakai?

Before you buy new access points, let's review your setup. In a free 30-minute consultation we look at your Wi-Fi, network and e-learning stack, and where the real bottleneck is.Sebelum membeli access point baru, mari tinjau dulu kondisinya. Dalam konsultasi gratis 30 menit, kita lihat Wi-Fi, jaringan, dan tech stack e-learning Anda, serta di mana hambatan sebenarnya.

Book a free consultationJadwalkan konsultasi gratis Save ContactSimpan Kontak

M. Afiful HashifTechnical Consultant · SiSTECH Kharisma · elhashif.net

Customer identity and identifying details are withheld for confidentiality.Identitas pelanggan dan detail yang dapat mengidentifikasinya tidak dicantumkan demi kerahasiaan.